Packages
attesto_phoenix
0.14.2
2.4.0
2.3.0
2.2.0
2.1.0
2.0.2
2.0.1
2.0.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
0.20.0
0.19.1
0.19.0
0.18.0
0.17.0
0.16.0
0.15.0
0.14.2
0.14.1
0.14.0
0.13.5
0.13.4
0.13.3
0.13.2
0.13.1
0.13.0
0.12.0
0.11.0
0.10.0
0.9.5
0.9.4
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.23
0.6.22
0.6.21
0.6.20
0.6.19
0.6.18
0.6.17
0.6.16
0.6.15
0.6.14
0.6.13
0.6.12
0.6.11
0.6.10
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
Phoenix/Ecto OAuth 2.0 / OIDC authorization server layer over attesto: authorization, token, PAR, revocation, discovery, JWKS, UserInfo, protected-resource plugs, and Ecto-backed token stores.
Current section
Files
Jump to
Current section
Files
lib/attesto_phoenix/scope_policy.ex
defmodule AttestoPhoenix.ScopePolicy do
@moduledoc """
The host-owned scope-authorization contract (RFC 6749 §3.3).
The library performs the scope algebra (`Attesto.Scope`), but which scopes a
given client may be granted is host policy. A host implements this behaviour
and wires the callback into `AttestoPhoenix.Config` under `:authorize_scope`;
this module is the contract that key installs and the recommended production
shape. When the key is unset, the library defaults to "the requested scope
must be a subset of `:scopes_supported`".
"""
@doc """
Validate and narrow a requested scope for a client (RFC 6749 §3.3).
Returns `{:ok, granted_scope}` with the (possibly narrowed) scope to issue,
or `{:error, :invalid_scope}` (RFC 6749 §5.2) to reject. `requested_scope`
is the list of requested scope strings.
"""
@callback authorize_scope(client :: term(), requested_scope :: [String.t()]) ::
{:ok, [String.t()]} | {:error, :invalid_scope}
end